Data security, privacy, and disaster recovery

Providers often need answers about data sovereignty, security controls, and business continuity for tenders, audits, or their own governance. This page covers the most common questions.

​

Where is our data stored?

All Visualcare functionality and data is hosted in Australia, in the Amazon Web Services (AWS) Sydney region (ap-southeast-2). Backups are stored in the AWS Melbourne region (ap-southeast-4).

​

Is our data encrypted?

Yes, both at rest and in transit.

• At rest: Data is encrypted within AWS, including file storage (S3) and database storage (RDS).
• In transit: All data travelling between Visualcare, the vWorker app, and API endpoints is encrypted using HTTPS/TLS (TLS 1.2 and 1.3, with AES-GCM cipher suites). Visualcare does not use any proprietary transport protocols.

​

Who can access our data?

​

Visualcare staff access

All systems that hold customer data, including AWS infrastructure and support systems, require multi-factor authentication (MFA). Additional restrictions, such as VPN access, apply where appropriate. Access is granted based on role and individual need, and is reviewed regularly. Administrator access is restricted, kept separate from everyday user accounts, and is not used for day-to-day work.

​

Controlling access within your organisation

Visualcare gives you tools to control what your own staff can see and how long they stay logged in:

• User group security and User access control let you restrict visibility of client profiles and incidents by user group.
• vCore users are automatically logged out after 24 hours.
• vWorker users are not automatically logged out by default. To make workers log in each time they open the app, turn on Require login each time in vWorker settings.

​

How is our data backed up?

Visualcare runs across multiple AWS availability zones within the Sydney region, so the platform stays available if a single AWS data centre fails.

• Automated backups run daily.
• All data is backed up to the AWS Melbourne region.
• Backups are retained for 30 days on a rolling basis.
• Backups are restored regularly as part of normal operations, and a dedicated disaster recovery test is run annually.

​

What disaster recovery documentation exists?

Visualcare maintains disaster recovery and business continuity documentation covering:

• Core systems and infrastructure
• Hosting providers
• Backup and recovery procedures
• Incident response and escalation

This documentation is reviewed twice yearly.

​

Can we see your security policy or disaster recovery plan?

These documents contain sensitive security information, so they aren’t shared in full. On request, Visualcare can provide a table of contents showing the areas each document covers, along with its review history. Contact your dedicated CSM or Visualcare Support to request this.

​

How is security tested?

Visualcare undertakes annual penetration testing. External providers also conduct information security reviews against ISO/IEC 27001.

​

What certifications does Visualcare hold?

Visualcare is certified to ISO/IEC 27001, the international standard for information security management. The certification was renewed in June 2026 (certificate number 202606-282). Visualcare also holds cyber insurance to support incident response and recovery.

​

What happens if there is a security incident or data breach?

Visualcare maintains incident response procedures, including playbooks for specific incident types such as outages and information security breaches. These procedures cover communication with affected customers and statutory authorities, including for notifiable data breaches, within the timeframes required by law. Critical incidents are escalated internally to senior engineering and leadership teams immediately.

​

Who do we contact in an emergency?

In the event of a natural disaster, system disruption or outage, or security incident, contact Visualcare Support through your normal support channels. In the event of an incident or outage, we will publish notifications via status.visualcare.com.au. Users can subscribe to notifications to receive email status updates.

​

Can we access information if the system is unavailable?

The daily roster send feature emails rosters every morning, giving you a copy of the day’s rosters if the system is temporarily unavailable. Once service is restored, data is recovered to the most recent backup point.

​

How long is our data kept, and how is it deleted?

Each customer’s data is isolated within the database, so it can be deleted in full as a single process. When you stop using Visualcare, we work with you to agree on the timing of deletion, based on any ongoing data needs you have. Visualcare does not keep your data for its own use. Deleted data is not removed from backups individually, as this would compromise the integrity of the backups. Instead, it expires from backups naturally at the end of the 30-day retention period.

​

How does Visualcare develop and test changes securely?

Visualcare keeps separate environments for development and testing. These are managed consistently with production, with additional access controls so they can’t be accessed directly. Testing does not rely on customer data. Occasionally, Visualcare may need access to your data in a test environment to reproduce and diagnose an issue, and will only do this with your permission. All code and configuration changes are:

• Peer reviewed
• Run through automated quality checks and analysis
• Attributed to an individual and tracked against a work item describing the change, its acceptance criteria, and security considerations

​

Related articles